intrinsic side-channel analysis resistance and e cient masking · optimizing masking costs {...
TRANSCRIPT
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Intrinsic Side-Channel Analysis Resistance andEfficient Masking
A case study of the use of SCA-related metrics and of designstrategies leading to low-cost masking for CAESAR candidates
Ko Stoffelen
Master thesis presentationAugust 27, 2015
Ko Stoffelen Master thesis presentation 1 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Acknowledgements
• Supervisor: Lejla Batina
• And Kostas Papagiannopoulos
• Second reader: Joan Daemen
Ko Stoffelen Master thesis presentation 2 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Outline
Introduction
SCA metrics
Optimizing masking costs – nonlinear operations
Optimizing masking costs – comparing CAESAR candidates
Conclusions
Ko Stoffelen Master thesis presentation 3 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Side-Channel Analysis
Ko Stoffelen Master thesis presentation 4 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Masking
• Countermeasure against SCA
• Arithmetic vs. Boolean
• Costs quadratic for nonlinear gates, e.g.:
z = x ∧ y → (x ′ = x ⊕ xm)
(y ′ = y ⊕ ym)
z ′ = x ′ ∧ y ′
zm = (xm ∧ y ′)⊕ (ym ∧ x ′)⊕ (xm ∧ ym)
Ko Stoffelen Master thesis presentation 5 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Goals
• How can known metrics be used at the design stage to assessthe intrinsic resistance of ciphers to implementation- anddevice-dependent attacks?
• How can the costs of applying masking countermeasures tociphers be reduced?
Ko Stoffelen Master thesis presentation 6 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Goals
• How can known metrics be used at the design stage to assessthe intrinsic resistance of ciphers to implementation- anddevice-dependent attacks?
• How can the costs of applying masking countermeasures tociphers be reduced?
Ko Stoffelen Master thesis presentation 6 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Context – CAESAR competition
ACORN ++AE AEGIS AES-CMCC AES-COBRAAES-COPA AES-CPFB AES-JAMBU AES-OTR AEZArtemia Ascon AVALANCHE Calico CBACBEAM CLOC Deoxys ELmD EnchiladaFASER HKC HS1-SIV ICEPOLE iFeed[AES]Joltik Julius Ketje Keyak KIASULAC Marble McMambo Minalpher MORUSNORX OCB OMD PAEQ PAESPANDA π-Cipher POET POLAWIS PRIMATEsPrøst Raviyoyla Sablier SCREAM SHELLSILC Silver STRIBOB Tiaoxin TriviA-ckWheesht YAES
Ko Stoffelen Master thesis presentation 7 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Context – CAESAR competition
ACORN ++AE AEGIS AES-CMCC AES-COBRAAES-COPA AES-CPFB AES-JAMBU AES-OTR AEZArtemia Ascon AVALANCHE Calico CBACBEAM CLOC Deoxys ELmD EnchiladaFASER HKC HS1-SIV ICEPOLE iFeed[AES]Joltik Julius Ketje Keyak KIASULAC Marble McMambo Minalpher MORUSNORX OCB OMD PAEQ PAESPANDA π-Cipher POET POLAWIS PRIMATEsPrøst Raviyoyla Sablier SCREAM SHELLSILC Silver STRIBOB Tiaoxin TriviA-ckWheesht YAES
Ko Stoffelen Master thesis presentation 8 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Context – CAESAR competition
ACORN ++AE AEGIS AES-CMCC AES-COBRAAES-COPA AES-CPFB AES-JAMBU AES-OTR AEZArtemia Ascon AVALANCHE Calico CBACBEAM CLOC Deoxys ELmD EnchiladaFASER HKC HS1-SIV ICEPOLE iFeed[AES]Joltik Julius Ketje Keyak KIASULAC Marble McMambo Minalpher MORUSNORX OCB OMD PAEQ PAESPANDA π-Cipher POET POLAWIS PRIMATEsPrøst Raviyoyla Sablier SCREAM SHELLSILC Silver STRIBOB Tiaoxin TriviA-ckWheesht YAES
Ko Stoffelen Master thesis presentation 9 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Context – CAESAR competition
(S-boxes of)
8x8 5x5 4x4
AES Ascon JoltikAES−1 ICEPOLE Joltik−1
iSCREAM Ketje/Keyak LACSCREAM PRIMATE MinalpherSCREAM−1 PRIMATE−1 Prøst
RECTANGLERECTANGLE−1
Ko Stoffelen Master thesis presentation 10 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Traditional S-box design criteria
S-box Width Nonlinearity Degree δ
AES 8 112 7 4iSCREAM 8 96 6 16SCREAM 8 96 5/6 16
Ascon 5 8 2 8ICEPOLE 5 8 4 8Ketje/Keyak 5 8 2 8PRIMATE 5 12 2/3 2
Joltik 4 4 3 4LAC 4 4 3 4Minalpher 4 4 3 4Prøst 4 4 3 4RECTANGLE 4 4 3 4
Ko Stoffelen Master thesis presentation 11 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
SCA metrics
Ko Stoffelen Master thesis presentation 12 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Why additional SCA-related criteria?
• SCA highly effective
• Countermeasures only applied to implementations
• Countermeasures expensive (area, speed)
• Perfect countermeasure does not exist
• A lot to gain with an intrinsically more resistant S-box
Ko Stoffelen Master thesis presentation 13 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Existing metrics
Number of measurements Guessing entropySignal-to-noise ratio Confusion coefficientTransparency order Modified transparency orderSuccess rate Second minimum distanceNew signal-to-noise ratio
Ko Stoffelen Master thesis presentation 14 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
But. . .
• Metrics take different approaches
• Metrics work under different assumptions (power model,Gaussian noise, . . . )
• Some only applicable in certain cases
• Not all meaningful in design stage
Ko Stoffelen Master thesis presentation 15 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Confusion coefficient
• Intuitively: probability that power analysis attack succeeds
• Result is frequency distribution
• Lower mean ⇒ higher resistance
• Mean only depends on size of S-box
• Higher variance ⇒ higher resistance
Ko Stoffelen Master thesis presentation 16 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Confusion coefficient – first-order
AES−1
AES
iSCREA
M
SCREA
M
Ket
je/K
eyak
SCREA
M−1
ICEPO
LE
Jolti
k
PRIM
ATE−1
PRIM
ATE
LAC
Jolti
k−1
Prøst
Asc
on
REC
TANGLE
REC
TANGLE−1
Min
alph
er0
0.05
0.1
0.15
0.2
0.25
0.3
0.35
0.4
0.45
0.5
cv
HWHDValueWeightedPairs
Ko Stoffelen Master thesis presentation 17 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Confusion coefficient – second-order
AES−1
AES
iSCREA
M
SCREA
M
Ket
je/K
eyak
SCREA
M−1
ICEPO
LE
Jolti
k
PRIM
ATE−1
PRIM
ATE
LAC
Jolti
k−1
Prøst
Asc
on
REC
TANGLE
REC
TANGLE−1
Min
alph
er0
0.05
0.1
0.15
0.2
0.25
0.3
0.35
0.4
0.45
0.5
cv
HWHDValueWeightedPairs
Ko Stoffelen Master thesis presentation 18 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Confusion coefficient conclusions
• Confusion coefficient can deal with low-entropy maskingschemes
• The ranking of the S-boxes according to the confusioncoefficient is mostly preserved by various power consumptionmodels
• The ranking of the S-boxes according to the confusioncoefficient is mostly preserved by higher-order attacks
• Assumption: mean and variance are of similar importance
Ko Stoffelen Master thesis presentation 19 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Confusion coefficient conclusions
• Confusion coefficient can deal with low-entropy maskingschemes
• The ranking of the S-boxes according to the confusioncoefficient is mostly preserved by various power consumptionmodels
• The ranking of the S-boxes according to the confusioncoefficient is mostly preserved by higher-order attacks
• Assumption: mean and variance are of similar importance
Ko Stoffelen Master thesis presentation 19 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Confusion coefficient conclusions
• Confusion coefficient can deal with low-entropy maskingschemes
• The ranking of the S-boxes according to the confusioncoefficient is mostly preserved by various power consumptionmodels
• The ranking of the S-boxes according to the confusioncoefficient is mostly preserved by higher-order attacks
• Assumption: mean and variance are of similar importance
Ko Stoffelen Master thesis presentation 19 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Confusion coefficient conclusions
• Confusion coefficient can deal with low-entropy maskingschemes
• The ranking of the S-boxes according to the confusioncoefficient is mostly preserved by various power consumptionmodels
• The ranking of the S-boxes according to the confusioncoefficient is mostly preserved by higher-order attacks
• Assumption: mean and variance are of similar importance
Ko Stoffelen Master thesis presentation 19 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
SCA metrics comparison
Jolti
kLA
C
Jolti
k−1
Prøst
REC
TANGLE
REC
TANGLE−1
Min
alph
er0
0.5
1
1.5
2
2.5
3
3.5
4
4.5
5
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
SNRTransparency order
Modified transparency orderSecond minimum distance
Confusion coefficient variance
Ko Stoffelen Master thesis presentation 20 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
SCA metrics comparison
Ket
je/K
eyak
ICEPO
LE
PRIM
ATE−1
PRIM
ATE
Asc
on2
2.5
3
3.5
4
4.5
5
5.5
6
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
SNRTransparency order
Modified transparency orderSecond minimum distance
Confusion coefficient variance
Ko Stoffelen Master thesis presentation 21 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
SCA metrics comparison
AES−1
AES
iSCREA
M
SCREA
M
SCREA
M−1
5
6
7
8
9
10
11
12
0
0.05
0.1
0.15
0.2
0.25
0.3
0.35
0.4
SNRTransparency order
Modified transparency orderSecond minimum distance
Confusion coefficient variance
Ko Stoffelen Master thesis presentation 22 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
SCA metrics verdict
• SNR, modified transparency order, and confusion coefficient areconsistent in their predictions
• Second minimum distance a bit less, requires further research
• Metrics behave as they should under various circumstances
• Minalpher, Ascon, SCREAM−1 are suggested to have the mostDPA-resistant S-boxes
• However. . .
Ko Stoffelen Master thesis presentation 23 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
SCA metrics verdict
• SNR, modified transparency order, and confusion coefficient areconsistent in their predictions
• Second minimum distance a bit less, requires further research
• Metrics behave as they should under various circumstances
• Minalpher, Ascon, SCREAM−1 are suggested to have the mostDPA-resistant S-boxes
• However. . .
Ko Stoffelen Master thesis presentation 23 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
SCA metrics verdict
• SNR, modified transparency order, and confusion coefficient areconsistent in their predictions
• Second minimum distance a bit less, requires further research
• Metrics behave as they should under various circumstances
• Minalpher, Ascon, SCREAM−1 are suggested to have the mostDPA-resistant S-boxes
• However. . .
Ko Stoffelen Master thesis presentation 23 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
SCA metrics verdict
• SNR, modified transparency order, and confusion coefficient areconsistent in their predictions
• Second minimum distance a bit less, requires further research
• Metrics behave as they should under various circumstances
• Minalpher, Ascon, SCREAM−1 are suggested to have the mostDPA-resistant S-boxes
• However. . .
Ko Stoffelen Master thesis presentation 23 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
SCA metrics verdict
• SNR, modified transparency order, and confusion coefficient areconsistent in their predictions
• Second minimum distance a bit less, requires further research
• Metrics behave as they should under various circumstances
• Minalpher, Ascon, SCREAM−1 are suggested to have the mostDPA-resistant S-boxes
• However. . .
Ko Stoffelen Master thesis presentation 23 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
SCA metrics verdict
• SCA simulation results do not agree• Usefulness of metrics still unclear
5 10 15 20 25 30 35 40 45 50 55 60 65 70 75 80 85 90 9595 1000.9
1
1.1
1.2
1.3
1.4
1.5
1.6
N
r′
AES−1
SCREAM−1
Ascon
Ketje/KeyakJoltikMinalpher
Ko Stoffelen Master thesis presentation 24 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Optimizing masking costs
Nonlinear operations
Ko Stoffelen Master thesis presentation 25 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Multiplicative complexity (MC)
• Recall that the cost of masking nonlinear operations isquadratic in the number of inputs
• Most nonlinear operations in the nonlinear part of the primitive:the S-box
• MC: minimal number of AND/OR gates required to implementfunction
• Goal is to compute the MC of CAESAR S-boxes
Ko Stoffelen Master thesis presentation 26 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Multiplicative complexity (MC)
• Recall that the cost of masking nonlinear operations isquadratic in the number of inputs
• Most nonlinear operations in the nonlinear part of the primitive:the S-box
• MC: minimal number of AND/OR gates required to implementfunction
• Goal is to compute the MC of CAESAR S-boxes
Ko Stoffelen Master thesis presentation 26 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Multiplicative complexity (MC)
• Recall that the cost of masking nonlinear operations isquadratic in the number of inputs
• Most nonlinear operations in the nonlinear part of the primitive:the S-box
• MC: minimal number of AND/OR gates required to implementfunction
• Goal is to compute the MC of CAESAR S-boxes
Ko Stoffelen Master thesis presentation 26 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Multiplicative complexity (MC)
• Recall that the cost of masking nonlinear operations isquadratic in the number of inputs
• Most nonlinear operations in the nonlinear part of the primitive:the S-box
• MC: minimal number of AND/OR gates required to implementfunction
• Goal is to compute the MC of CAESAR S-boxes
Ko Stoffelen Master thesis presentation 26 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Minimizing AND/OR gates
• Existing logic synthesis tools not very helpful• E.g. Espresso, SIS, misII, Logic Friday, ABC, . . .
• Instead: convert to SAT and let SAT solvers do the work
• Converting problem to SAT nontrivial, but feasible
Ko Stoffelen Master thesis presentation 27 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Reducing decisional MC to SAT
q0 = a0 + a1 · x0 + a2 · x1 + a3 · x2 + a4 · x3
q1 = a5 + a6 · x0 + a7 · x1 + a8 · x2 + a9 · x3
t0 = q0 · q1
q2 = a10 + a11 · x0 + a12 · x1 + a13 · x2 + a14 · x3 + a15 · t0
q3 = a16 + a17 · x0 + a18 · x1 + a19 · x2 + a20 · x3 + a21 · t0
t1 = q2 · q3
q4 = a22 + a23 · x0 + a24 · x1 + a25 · x2 + a26 · x3 + a27 · t0 + a28 · t1
q5 = a29 + a30 · x0 + a31 · x1 + a32 · x2 + a33 · x3 + a34 · t0 + a35 · t1
t2 = q4 · q5
y0 = a36x0 + a37 · x1 + a38 · x2 + a39 · x3 + a40 · t0 + a41 · t1 + a42 · t2
y1 = a43x0 + a44 · x1 + a45 · x2 + a46 · x3 + a47 · t0 + a48 · t1 + a49 · t2
y2 = a50x0 + a51 · x1 + a52 · x2 + a53 · x3 + a54 · t0 + a55 · t1 + a56 · t2
y3 = a57x0 + a58 · x1 + a59 · x2 + a60 · x3 + a61 · t0 + a62 · t1 + a63 · t2
Ko Stoffelen Master thesis presentation 28 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
My work
• Wrote scripts to generate logic formulas in ANF from S-boxand given MC
• Use tool to convert ANF to CNF
• Let MiniSAT and CryptoMiniSAT do the work on DS clusternode
• Wrote scripts to convert back to S-box implementation
Ko Stoffelen Master thesis presentation 29 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Results
S-box MC S-box MC
AES ≤ 32 PRIMATE−1 ∈ {6, 7, 8, 9, 10}*AES−1 ≤ 32 Joltik 4iSCREAM ≤ 12 Joltik−1 4*SCREAM ≤ 11 LAC 4*SCREAM−1 ≤ 11 Minalpher 5*Ascon 5 Prøst 4ICEPOLE 6* RECTANGLE 4Ketje/Keyak 5 RECTANGLE−1 4*PRIMATE ∈ {6, 7}*
Ko Stoffelen Master thesis presentation 30 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Optimizing masking costs
Comparing CAESAR candidates
Ko Stoffelen Master thesis presentation 31 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
High-level operations
• Table lookups
• Bitwise Boolean functions
• Shifts and rotates
• Modular addition/multiplication
• Modular polynomial multiplication
Ko Stoffelen Master thesis presentation 32 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Results
OperationTablelookups
BitwiseBoolean
Shifts/rotates
Mod. add.and mult.
Mod. poly.mult.
AES 256 bytes XOR Fixed XiSCREAM 512 bytes AND,OR,XOR Fixed × mod 256SCREAM 512 bytes AND,OR,XOR × mod 256
Ascon AND,OR,XOR FixedICEPOLE 96 bytes AND,XOR FixedKetje/Keyak AND,XOR FixedPRIMATE 25 bytes XOR Fixed XJoltik 64 bytes XOR Fixed + mod 16 XLAC 16 bytes XOR FixedMinalpher 16 bytes XOR
Prøst AND,XOR FixedRECTANGLE AND,OR,XOR Fixed
Ko Stoffelen Master thesis presentation 33 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Results
• Expected masking costs not so high on average
• Ascon, Ketje, Keyak, LAC, Minalpher, Prøst, and RECTANGLEstand out
• Designers should use operations that are cheap to mask using aBoolean scheme
Ko Stoffelen Master thesis presentation 34 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Conclusions
• SNR, modified transparency order, and confusion coefficientcredible in theory
• However, SCA simulations do not reflect the expectationssuggested by metrics
• For 4- and 5-bit S-boxes, we can find an implementation with aprovably minimum number of AND/OR operations
• Ascon, Ketje, Keyak, LAC, Minalpher, Prøst, and RECTANGLEare expected to have the lowest masking costs
Ko Stoffelen Master thesis presentation 35 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Conclusions
• SNR, modified transparency order, and confusion coefficientcredible in theory
• However, SCA simulations do not reflect the expectationssuggested by metrics
• For 4- and 5-bit S-boxes, we can find an implementation with aprovably minimum number of AND/OR operations
• Ascon, Ketje, Keyak, LAC, Minalpher, Prøst, and RECTANGLEare expected to have the lowest masking costs
Ko Stoffelen Master thesis presentation 35 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Conclusions
• SNR, modified transparency order, and confusion coefficientcredible in theory
• However, SCA simulations do not reflect the expectationssuggested by metrics
• For 4- and 5-bit S-boxes, we can find an implementation with aprovably minimum number of AND/OR operations
• Ascon, Ketje, Keyak, LAC, Minalpher, Prøst, and RECTANGLEare expected to have the lowest masking costs
Ko Stoffelen Master thesis presentation 35 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Conclusions
• SNR, modified transparency order, and confusion coefficientcredible in theory
• However, SCA simulations do not reflect the expectationssuggested by metrics
• For 4- and 5-bit S-boxes, we can find an implementation with aprovably minimum number of AND/OR operations
• Ascon, Ketje, Keyak, LAC, Minalpher, Prøst, and RECTANGLEare expected to have the lowest masking costs
Ko Stoffelen Master thesis presentation 35 / 36
IntroductionSCA metrics
Optimizing masking costs – nonlinear operationsOptimizing masking costs – comparing CAESAR candidates
ConclusionsRadboud University
Questions
?
Ko Stoffelen Master thesis presentation 36 / 36